Xxe

The SourceHttpMessageConverter in Spring MVC in Spring Framework before 3.2.5 and 4.0.0.M1 through 4.0.0.RC1 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML, aka an XML External...

CVE-2013-6429

The SourceHttpMessageConverter in Spring MVC in Spring Framework before 3.2.5 and 4.0.0.M1 through 4.0.0.RC1 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML, aka an XML External...

CVE-2013-7315

The Spring MVC in Spring Framework before 3.2.4 and 4.0.0.M1 through 4.0.0.M2 does not disable external entity resolution for the StAX XMLInputFactory, which allows context-dependent attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML with JAXB,...

CVE-2013-4152

The Spring OXM wrapper in Spring Framework before 3.2.4 and 4.0.0.M1, when using the JAXB marshaller, does not disable entity resolution, which allows context-dependent attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via an XML external entity declaration in...

CVE-2013-4152

The Spring OXM wrapper in Spring Framework before 3.2.4 and 4.0.0.M1, when using the JAXB marshaller, does not disable entity resolution, which allows context-dependent attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via an XML external entity declaration in...

CVE-2013-4152

The Spring OXM wrapper in Spring Framework before 3.2.4 and 4.0.0.M1, when using the JAXB marshaller, does not disable entity resolution, which allows context-dependent attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via an XML external entity declaration in...

CVE-2013-4152

The Spring OXM wrapper in Spring Framework before 3.2.4 and 4.0.0.M1, when using the JAXB marshaller, does not disable entity resolution, which allows context-dependent attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via an XML external entity declaration in...

Moderate: Red Hat Security Advisory: cfme security, bug fix, and enhancement update

Updated cfme packages that fix one security issue, several bugs, and add various enhancements are now available for Red Hat CloudForms 3.0. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System CVSS base score, which giv...

Debian Security Advisory DSA 2842-1 (libspring-java - denial of service)

Alvaro Munoz discovered a XML External Entity XXE injection in the Spring Framework which can be used for conducting CSRF and DoS attacks on other sites. The Spring OXM wrapper did not expose any property for disabling entity resolution when using the JAXB unmarshaller. There are four possible...

Seagate BlackArmor NAS sg2000-2000.1331跨站请求伪造漏洞

No description provided by source. Exploit Title: Seagate BlackArmor NAS - Cross Site Request Forgery Google Dork: N/A Date: 04-01-2014 Exploit Author: Jeroen - IT Nerdbox Vendor Homepage: http://www.seagate.com/ Software Link:...

Seagate BlackArmor NAS sg2000-2000.1331 - Cross-Site Request Forgery

Exploit Title: Seagate BlackArmor NAS - Cross Site Request Forgery Google Dork: N/A Date: 04-01-2014 Exploit Author: Jeroen - IT Nerdbox Vendor Homepage: http://www.seagate.com/ Software Link: http://www.seagate.com/support/downloads/item/banas-220-firmware-master-dl/ Version: sg2000-2000.1331...

Seagate BlackArmor NAS sg2000-2000.1331 Cross Site Request Forgery

Exploit Title: Seagate BlackArmor NAS - Cross Site Request Forgery Google Dork: N/A Date: 04-01-2014 Exploit Author: Jeroen - IT Nerdbox Vendor Homepage: http://www.seagate.com/ Software Link: http://www.seagate.com/support/downloads/item/banas-220-firmware-master-dl/ Version: sg2000-2000.1331...

MediaWiki < 1.19.9 / 1.20.8 / 1.21.3 Multiple Vulnerabilities

According to its version number, the instance of MediaWiki running on the remote host is affected by the following vulnerabilities : - Input validation errors exist that allow cross-site scripting attacks. CVE-2013-4567, CVE-2013-4568 - An error exists related to session IDs and HTTP headers that...

IBM WebSphere Application Server 8.5 < Fix Pack 8.5.5.1 Multiple Vulnerabilities

IBM WebSphere Application Server 8.5 before Fix Pack 8.5.5.1 appears to be running on the remote host and is, therefore, potentially affected by the following vulnerabilities : - A flaw exists related to Apache Ant and file compression that could lead to denial of service conditions. CVE-2012-209...

SuSE Update for MozillaFirefox openSUSE-SU-2013:1142-1 (MozillaFirefox)

Check for the Version of MozillaFirefox OpenVAS Vulnerability Test $Id: gbsuse201311421.nasl 8456 2018-01-18 06:58:40Z teissa $ SuSE Update for MozillaFirefox openSUSE-SU-2013:1142-1 MozillaFirefox Authors: System Generated Check Copyright: Copyright C 2013 Greenbone Networks GmbH,...

SuSE Update for update openSUSE-SU-2013:1176-1 (update)

Check for the Version of update OpenVAS Vulnerability Test $Id: gbsuse201311761.nasl 8542 2018-01-26 06:57:28Z teissa $ SuSE Update for update openSUSE-SU-2013:1176-1 update Authors: System Generated Check Copyright: Copyright C 2013 Greenbone Networks GmbH, http://www.greenbone.net This program ...

SuSE Update for regular openSUSE-SU-2013:1140-1 (regular)

Check for the Version of regular OpenVAS Vulnerability Test $Id: gbsuse201311401.nasl 8494 2018-01-23 06:57:55Z teissa $ SuSE Update for regular openSUSE-SU-2013:1140-1 regular Authors: System Generated Check Copyright: Copyright C 2013 Greenbone Networks GmbH, http://www.greenbone.net This progr...

SuSE Update for MozillaThunderbird openSUSE-SU-2013:1141-1 (MozillaThunderbird)

Check for the Version of MozillaThunderbird OpenVAS Vulnerability Test $Id: gbsuse201311411.nasl 8542 2018-01-26 06:57:28Z teissa $ SuSE Update for MozillaThunderbird openSUSE-SU-2013:1141-1 MozillaThunderbird Authors: System Generated Check Copyright: Copyright C 2013 Greenbone Networks GmbH,...

openSUSE: Security Advisory for MozillaFirefox (openSUSE-SU-2013:1142-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

openSUSE: Security Advisory for regular (openSUSE-SU-2013:1140-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...